Fuzzer: When nested under makeTrivial(), avoid normal make() (#5657)

Without this, in certain complex operations we could end up calling a nested
make() operation that included nontrivial things, which could cause problems.
The specific problem I encountered was in fixAfterChanges() we tried to fix up
a duplicate label, but calling makeTrivial() emitted something very large that
happened to include a new block with a new label nested under a struct.get,
and that block's label conflicted with a label we'd already processed.

2 files changed, 16 insertions, 0 deletions

diff --git a/src/tools/fuzzing.h b/src/tools/fuzzing.h
index f055d7f44..c0f6ab335 100644
--- a/src/tools/fuzzing.h
+++ b/src/tools/fuzzing.h
@@ -271,6 +271,10 @@ private:
   // Make something with no chance of infinite recursion.
   Expression* makeTrivial(Type type);
 
+  // We must note when we are nested in a makeTrivial() call. When we are, all
+  // operations must try to be as trivial as possible.
+  int trivialNesting = 0;
+
   // Specific expression creators
   Expression* makeBlock(Type type);
   Expression* makeLoop(Type type);
diff --git a/src/tools/fuzzing/fuzzing.cpp b/src/tools/fuzzing/fuzzing.cpp
index 1c2b818df..d062dd5c8 100644
--- a/src/tools/fuzzing/fuzzing.cpp
+++ b/src/tools/fuzzing/fuzzing.cpp
@@ -1060,6 +1060,10 @@ void TranslateToFuzzReader::addInvocations(Function* func) {
 
 Expression* TranslateToFuzzReader::make(Type type) {
   auto subtype = getSubType(type);
+  if (trivialNesting) {
+    // We are nested under a makeTrivial call, so only emit something trivial.
+    return makeTrivial(type);
+  }
   // When we should stop, emit something small (but not necessarily trivial).
   if (random.finished() || nesting >= 5 * NESTING_LIMIT || // hard limit
       (nesting >= NESTING_LIMIT && !oneIn(3))) {
@@ -1226,6 +1230,14 @@ Expression* TranslateToFuzzReader::_makeunreachable() {
 }
 
 Expression* TranslateToFuzzReader::makeTrivial(Type type) {
+  struct TrivialNester {
+    TranslateToFuzzReader& parent;
+    TrivialNester(TranslateToFuzzReader& parent) : parent(parent) {
+      parent.trivialNesting++;
+    }
+    ~TrivialNester() { parent.trivialNesting--; }
+  } nester(*this);
+
   if (type.isConcrete()) {
     if (oneIn(2) && funcContext) {
       return makeLocalGet(type);